flat assembler
Message board for the users of flat assembler.

Index > Heap > Safer Mode Extensions? (LaGrande)

Author
Thread Post new topic Reply to topic
MazeGen



Joined: 06 Oct 2003
Posts: 975
Location: Czechoslovakia
MazeGen
While skimming through Intel manuals, I get stuck on "Safer Mode Extensions Reference" (Chapter 6 in Instruction Set Reference Manual, N-Z).

Never heard about that before. I've tried to get some understandable paper about this, but all what I've found is an outdated paper by Intel:

http://www.intel.com/technology/security/downloads/LT_spec_0906.pdf

Is anyone aware of some nice explanation of this technology?
Post 14 Dec 2007, 14:30
View user's profile Send private message Visit poster's website Reply with quote
edfed



Joined: 20 Feb 2006
Posts: 4237
Location: 2018
edfed
interresting, all explanation are in this outdated paper...
it's applied to virtual machines, it's a background hardware control set.
it permitts the presence of multiples OS in the same processor.
Post 14 Dec 2007, 14:44
View user's profile Send private message Visit poster's website Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
MazeGen, at http://www.intel.com/technology/security/ you can get the same paper released in 2007 as long with some overviews. Not seems to be what you are looking for but at least other people can learn more about this Laughing

[edit] And the wikipedia: http://en.wikipedia.org/wiki/LaGrande [/edit]
Post 14 Dec 2007, 14:52
View user's profile Send private message Reply with quote
MazeGen



Joined: 06 Oct 2003
Posts: 975
Location: Czechoslovakia
MazeGen
Thanks, I've missed the updated one.

BTW, some third-side overview would be nicer, Intel style is quite... dry.
Post 14 Dec 2007, 15:08
View user's profile Send private message Visit poster's website Reply with quote
edfed



Joined: 20 Feb 2006
Posts: 4237
Location: 2018
edfed
Laughing thanks Laughing

but how to detect the presence of malicious software?
i'm sure that there is a flaw in their security system...


Last edited by edfed on 14 Dec 2007, 15:14; edited 1 time in total
Post 14 Dec 2007, 15:10
View user's profile Send private message Visit poster's website Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
edfed: what does detecting malicious software have to do with SMX?
Post 14 Dec 2007, 15:13
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
edfed



Joined: 20 Feb 2006
Posts: 4237
Location: 2018
edfed
it's to protect from malicious software attack, but prevent is better than cure...
detecting malicious software and kill them is better than isolate them and let them live.
Post 14 Dec 2007, 15:16
View user's profile Send private message Visit poster's website Reply with quote
LocoDelAssembly
Your code has a bug


Joined: 06 May 2005
Posts: 4633
Location: Argentina
LocoDelAssembly
MazeGen, I would swear that I saw a nice schematics before, but only talked about the chipset and how it would protect access to peripherals and the like (with no details of how to program it). I have no clue where I looked it but was long time ago.

[edit]Oh, maybe http://www.hardwaresecrets.com/article/264 is what I saw[/edit]
Post 14 Dec 2007, 15:38
View user's profile Send private message Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
edfed: Trusted Computing prevents malware from doing *some* bad stuff, but not by looking for it and "killing" it. That would be idiotic.

Anyway, malware is not primary concern of TC, I'd say copy protection is.
Post 14 Dec 2007, 16:00
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
HyperVista



Joined: 18 Apr 2005
Posts: 691
Location: Virginia, USA
HyperVista
Hi MazeGen. The Safer Mode Extensions (SMX) are a component of the Intel Safer Computing Initiative, formerly known as La Grande. SMX is used to measure a virtual machine monitor (cryptographic hash generated) and SMX is also used to verify or attest (check hash) of a virtual machine monitor before it is allowed to run.

This Safer Computing Initiative is a grand unification architechture that includes specific Intel CPUs and chipsets that support the intiative (VMX, etc.) , OS support for the intiative, and the TPM (Trusted Platform Module - a secure chip that supports cryptography and storage).

There are six pillars of the initiative:

1) Protected execution (Domain separation, memory protection, etc. - virtualization supports this pillar of the initiative)

2) Sealed storage (Disk encryption - Full Volume Encryption (FVE))

3) Protected Input (Secure keyboard and mouse - plans to encrypt on the Bus)

4) Protected Graphics (Secure video architecture - plans to encrypt on the Bus)

5) Attestation (validation and verification of the platform and key software/firmware before allowing to run. cryptographic hash values stored and checked in the TPM chip - This is where SMX comes in because the SMX instructions are used to attest, or validate the virtual machine monitor (hypervisor) before it is allowed to launch).

6) Protected Launch - Secure Bootloader and TPM work together to attest or validate that the OS is correct and has not been tampered with since that last boot.

So, the SMX instructions are used to measure the virtual machine monitor (VMM, or hypervisor), which means it initiates a secure hash value for the VMM and stores that value in the TPM chip, which is an extremely secure chip on the motherboard. The SMX instructions are used prior to launching a VMM to initiate a check of the secured hash value stored in the TPM against the signature of the VMM.

The SMX instructions provide the ability to perform an accurate measurement of the VMM. To ensure the accuracy, the Safer Computing Initiative platform relies on CPU synchronization, authenticated code execution, and measurement, measurement of the VMM by the Authenticated Code (AC) modure, and storing the AC module and VMM measurement in the TPM chip.

The measurement process is not simply a CPU mechanism, the chipset must participate too. The chipset provides the hardware mechanisms for the following features:

- The ability to accept a VMM measurement

- A way to ensure that only the SMX instructions can attempt to store the VMM measurement

- The mechanism for passing the VMM measurement to the TPM chip

So, the SMX instructions are part of the Intel Safer Computing Initiative (La Grande) and work in conjuction with a La Grande compliant platform that includes specialized CPUs, specialized chipsets and the TPM chip (which in most cases today is attached to the motherboard).

I know this was rather lengthy post, but I hope it helped clarify the SMX instructions a bit.
Post 16 Dec 2007, 05:27
View user's profile Send private message Visit poster's website Reply with quote
tom tobias



Joined: 09 Sep 2003
Posts: 1320
Location: usa
tom tobias
HyperVista wrote:
...So, the SMX instructions are used to measure the virtual machine monitor (VMM, or hypervisor), which means it initiates a secure hash value for the VMM and stores that value in the TPM chip, which is an extremely secure chip on the motherboard. The SMX instructions are used prior to launching a VMM to initiate a check of the secured hash value stored in the TPM against the signature of the VMM.
"extremely secure"?? Hmm. Reminds me of Jerry Fletcher in the movie Conspiracy Theory:
http://www.imdb.com/title/tt0118883/
Jerry kept his most precious material locked up in a can stored inside his refrigerator, which was padlocked shut, sitting inside his triple locked apartment.
I wonder how much material has been lost from the Pentagon via computer theft by unauthorized users (hacking), versus good old fashioned spying (Robert Hansson), a situation in which the spy, like Hansson, has bona fide computer access to all the material, and none of these chip set/instruction set modifications would have improved genuine security, but rather, as with Jerry's locked can inside the locked refrigerator, inside the locked apartment, will simply increase taxpayers' donations to support Federal bloat, with a concomitant loss of performance of the computer, thus further reducing the already abysmal productivity.
I guess the real question is this: how is this "extremely secure" chipset/cpu instruction combination going to prevent human anger, fear, or greed, i.e. the motives for spying?
http://globaltechforum.eiu.com/index.asp?layout=rich_story&doc_id=8807&categoryid=&channelid=&search=consensus
http://news.zdnet.co.uk/internet/0,1000000097,39289250,00.htm
http://www.globalsecurity.org/org/news/2005/051007-spy-system.htm
Post 16 Dec 2007, 08:37
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17279
Location: In your JS exploiting you and your system
revolution
Well tom tobias likes to shift the topic focus. In this case it is probably okay since there is little more to be said about the SMX. Companies will choose to either include all the necessary hardware of ignore it as they see fit.

tom tobias' suggestion about it not helping security is interesting. I foresee that in the short term it will help to reduce theft and loss but only because people will have a hard time understanding it. However in the long term I expect it will be business as usual for the hackers. It is just a big game
Code:
security:
 inc [strength_of_your_fortress]
 inc [the_strength_of_opponents_break_in_tools]
 jmp security    
Post 16 Dec 2007, 08:56
View user's profile Send private message Visit poster's website Reply with quote
HyperVista



Joined: 18 Apr 2005
Posts: 691
Location: Virginia, USA
HyperVista
I suppose I should describe the TPM chip in a little more detail to explain my use of the adjective "extrememly" secure.

The TPM chip is a postage stamp sized chip that has the following security features:

1) It has 35 meters of wire grid across the top of the chip. A digital signal is running through half of the grid and the inverted signal is running across the other half of the grid. If the TPM chip is physically tampered with (attemps to remove it from the motherboard) this wire grid and signals will be interferred with and the chip will zero itself. Recall that is chip is the size of a small postage stamp and there is 35 meters of wire grid on top of it!!

2) It has a thermal coating to prevent thermal, IR, or x-ray examination of it's inner working.

3) There are light sensors dotting the top of the chip to prevent high initensity photon guns from altering discrete bits as they traverse the chip.

4) There are random delayed code writes and random junk code writes on the output pins to prevent any correlation between input values and output results.

There are more security features of this interesting chip, but those are the ones that come to mind this early Sunday morning.

And tom, you are right. There are really two categories of security threat our security specialists are dealing with; the outside hacker threat and the ever present insider threat. Much has been done and written about the outside hacker threat. There are many interesting advances recently to address the insider threat.

As for the profession of spying, it truly is the second oldest profession Very Happy

P.S - I promise to get the DVD disk of your fasm conference presentation in the mail tomorrow. My apologies for the delay, but I've been traveling quite a bit and my work load the past two months have been crushing.
Post 16 Dec 2007, 15:03
View user's profile Send private message Visit poster's website Reply with quote
f0dder



Joined: 19 Feb 2004
Posts: 3170
Location: Denmark
f0dder
Obviously the SMX platform by itself doesn't prevent all attack vectors, but it does up the ante quite a bit - making it very hard to get rootkits installed, and other spying measures as well. Topped with Full Disk Encryption, losing a laptop is no longer that much of a problem.

As for inside threats, disable USB ports, firewire, and don't install floppy or DVD-RW/CD-RW drives. Presto, done. Or getting there, anyway Smile
Post 16 Dec 2007, 15:49
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17279
Location: In your JS exploiting you and your system
revolution
One thing that always bothers me with technologies like this is:

Who holds the keys?

If the answer is someone like Microsoft or the governments then forget about it, I'll use different hardware.
Post 17 Dec 2007, 04:45
View user's profile Send private message Visit poster's website Reply with quote
tom tobias



Joined: 09 Sep 2003
Posts: 1320
Location: usa
tom tobias
revolution wrote:
...I'll use different hardware.
yes, precisely.
HyperVista wrote:
...the DVD disk of your fasm conference presentation...
Thanks HyperVista, and, well, this is my response to the above debate: I believe that revolution's notion is well founded, and it was in that spirit that I proposed a radically different architecture, at the FASM conference, a design fundamentallly opposite to the Pentagon mentality driving this "second oldest profession." My theory is very simple: as with the oldest profession itself, or herself as the case may be, if it is free, (i.e. transparent) or nearly so, then much of the professions' rationale disappears.
It is difficult to persuade voters to support increased tax revenues to purchase exotic computers ostensibly to thwart spying, if there are no secrets, hence no need for spies. My guess, only an opinion, maybe completely wrong, but I predict, or I bet, that if one examined ALL of the SECRET documents held by the Department of Defense, and the Central Intelligence Agency, and so on, then, 95% of those "secret" documents contain information, which today, let us suppose, thirty years later, appears utterly benign, or, if embarrassing, points only to some bureaucrat, technician, politician, or official, who committed an error in his/her employment, and used the secrecy not to prevent exposure of a SCIENTIFIC OR MILITARY technological breakthrough of national significance, but rather, to simply prevent exposure of individual incompetence.
Smile
Post 17 Dec 2007, 09:03
View user's profile Send private message Reply with quote
MazeGen



Joined: 06 Oct 2003
Posts: 975
Location: Czechoslovakia
MazeGen
Hi HyperVista, thanks for this introduction! I've never heard about Safer Computing Initiative so it is worth for me (and I believe also for others).
Post 17 Dec 2007, 09:40
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar.

Powered by rwasa.